The Toronto District School Board (TDSB) is advising parents of a cyber security incident involving an online platform the board uses to store student information.
But the board said at this point it has been told any information that was accessed has been deleted.
In a note sent out to parents, the board said it received notification on Jan. 7 from PowerSchool — an application used by school boards — that they had experienced a data breach which took place over the holidays when school was not in session, from Dec. 22 to 28. Other school boards in Ontario and North America also received the notification.
The platform is used to store student information and "a limited amount of school-based staff information," the board said.
"Our cybersecurity team promptly activated our response plan, taking immediate steps to ensure that our critical systems remain operational," states the letter, signed by Stacey Zucker, the TDSB's interim director of education.
"PowerSchool has informed us that it has received confirmation that the data accessed by an unauthorized user has been deleted and that no copies of this data were posted online."
Zucker wrote that the board is "still assessing the exact information that may have been accessed or exported from the application," and that they are working with PowerSchool to conduct a thorough investigation of the incident.
Zucker said the board will inform families as soon as possible, if they determine any personal information has been impacted. Zucker also said the board has notified the Information and Privacy Commissioner of Ontario about the incident "out of an abundance of caution."
"Many of you will have questions as a result of this news, but given the ongoing investigation into what occurred, we do not yet have more information to share at this time," Zucker said.
Zucker said the board said it will update the community as more information becomes available.
When asked about the cyber security incident, a TDSB spokesperson directed TorontoToday to a statement from PowerSchool.
"PowerSchool has taken all appropriate steps, including informing law enforcement, to prevent the data involved from further unauthorized access or misuse," the company said. "We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination."
A PowerSchool spokesperson said the company "will be providing credit monitoring to affected adults and identity protection services to affected minors in accordance with regulatory and contractual obligations."
Disruptions are not expected within the PowerSchool program, the spokesperson maintained.
